Overview

overview

10

Static

static

10

Challenge_...m.docx

windows7-x64

4

Challenge_...m.docx

windows10-2004-x64

1

Challenge_...1.docx

windows7-x64

4

Challenge_...1.docx

windows10-2004-x64

1

Challenge_...y.docx

windows7-x64

4

Challenge_...y.docx

windows10-2004-x64

1

Challenge_...1.docx

windows7-x64

1

Challenge_...1.docx

windows10-2004-x64

1

tools/numb...ing.py

ubuntu-18.04-amd64

1

tools/numb...ing.py

debian-9-armhf

1

tools/numb...ing.py

debian-9-mips

1

tools/numb...ing.py

debian-9-mipsel

1

decoder_add1.py

ubuntu-18.04-amd64

1

decoder_add1.py

debian-9-armhf

1

decoder_add1.py

debian-9-mips

1

decoder_add1.py

debian-9-mipsel

1

decoder_ah.py

ubuntu-18.04-amd64

1

decoder_ah.py

debian-9-armhf

1

decoder_ah.py

debian-9-mips

1

decoder_ah.py

debian-9-mipsel

1

decoder_chr.py

ubuntu-18.04-amd64

1

decoder_chr.py

debian-9-armhf

1

decoder_chr.py

debian-9-mips

1

decoder_chr.py

debian-9-mipsel

1

decoder_rol1.py

ubuntu-18.04-amd64

1

decoder_rol1.py

debian-9-armhf

1

decoder_rol1.py

debian-9-mips

1

decoder_rol1.py

debian-9-mipsel

1

decoder_xor1.py

ubuntu-18.04-amd64

1

decoder_xor1.py

debian-9-armhf

1

decoder_xor1.py

debian-9-mips

1

decoder_xor1.py

debian-9-mipsel

1

Analysis

  • max time kernel
    1799s
  • max time network
    1124s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231127-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12-12-2023 02:26

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Challenge_FIles/income_tax_and_benefit_return_2021.docx

  • Size

    23KB

  • MD5

    55998cb43459159a5ed4511f00ff3fc8

  • SHA1

    9bec2182cc5b41fe8783bb7ab6e577bac5c19f04

  • SHA256

    d0e1f97dbe2d0af9342e64d460527b088d85f96d38b1d1d4aa610c0987dca745

  • SHA512

    8f04951f9efb5acdad0a625d9f63154089d552fe4281ca53a759cc0a0468b8d9c76af863e34ed6e00802225a4408bcda1110a6efce30357e6173973ea5bf7838

  • SSDEEP

    384:Q6UDg00MWEg9fPCPyH111/elBqhveoNHfn5yAehqbhtgyhdCxi556BjsbIwRq:QcMWE04uebyvNv5yHcttg6dwc5YQb5w

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Challenge_FIles\income_tax_and_benefit_return_2021.docx" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • NTFS ADS
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:3568

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

3
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3568-0-0x00007FFDE6A10000-0x00007FFDE6A20000-memory.dmp
    Filesize

    64KB

    Download
  • memory/3568-1-0x00007FFDE6A10000-0x00007FFDE6A20000-memory.dmp
    Filesize

    64KB

    Download
  • memory/3568-2-0x00007FFE26990000-0x00007FFE26B85000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/3568-3-0x00007FFDE6A10000-0x00007FFDE6A20000-memory.dmp
    Filesize

    64KB

    Download
  • memory/3568-4-0x00007FFE26990000-0x00007FFE26B85000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/3568-6-0x00007FFE26990000-0x00007FFE26B85000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/3568-5-0x00007FFDE6A10000-0x00007FFDE6A20000-memory.dmp
    Filesize

    64KB

    Download
  • memory/3568-7-0x00007FFDE6A10000-0x00007FFDE6A20000-memory.dmp
    Filesize

    64KB

    Download
  • memory/3568-8-0x00007FFE26990000-0x00007FFE26B85000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/3568-9-0x00007FFE26990000-0x00007FFE26B85000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/3568-10-0x00007FFE26990000-0x00007FFE26B85000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/3568-11-0x00007FFE26990000-0x00007FFE26B85000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/3568-12-0x00007FFE26990000-0x00007FFE26B85000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/3568-13-0x00007FFE26990000-0x00007FFE26B85000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/3568-14-0x00007FFE26990000-0x00007FFE26B85000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/3568-15-0x00007FFE26990000-0x00007FFE26B85000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/3568-16-0x00007FFE26990000-0x00007FFE26B85000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/3568-17-0x00007FFDE4230000-0x00007FFDE4240000-memory.dmp
    Filesize

    64KB

    Download
  • memory/3568-18-0x00007FFDE4230000-0x00007FFDE4240000-memory.dmp
    Filesize

    64KB

    Download
  • memory/3568-42-0x00007FFE26990000-0x00007FFE26B85000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/3568-43-0x00007FFE26990000-0x00007FFE26B85000-memory.dmp
    Filesize

    2.0MB

    Download